Is SneakNote Safe?

End-to-End Encryption

SneakNote uses end-to-end encryption to ensure that your note content is encrypted in your browser before it ever reaches the servers. The encryption key is embedded in the URL fragment (the part after the # symbol), which is never sent to the server. This means I cannot read your notes even if I wanted to.

Server-Side Encryption at Rest

In addition to client-side encryption, note data stored on the servers is encrypted at rest. Even in the unlikely event of a server breach, an attacker would find only encrypted blobs: not readable content. Without the decryption key (which only exists in the shared link), the data is useless.

No Plaintext Storage

At no point in the lifecycle of a note does SneakNote store your content in plaintext. The note is encrypted before transmission, stored encrypted, and decrypted only in the recipient's browser. Server logs do not capture note content, and I do not run analytics or tracking on what you write.

Self-Destructing Notes

Every note created on SneakNote is designed to self-destruct. Once the recipient reads the note, it is permanently deleted from the servers. You can also set a time-based expiration so that unread notes are automatically destroyed after a period you choose. This limits the window during which your data exists at all.

Optional Password Protection

For an extra layer of security, you can add a password to any note. The recipient must enter the correct password before the note can be decrypted. This is especially useful when you send the link through one channel and the password through another, an approach that significantly reduces the risk of interception.

HTTPS and Security Headers

All connections to SneakNote are served over HTTPS with TLS encryption. I also enforce modern security headers including strict transport security, content security policy, and protection against clickjacking and cross-site scripting. These measures ensure that the communication between your browser and the servers is secure.

What I Am Transparent About

No system is perfectly secure, and honesty is more valuable than false promises. SneakNote cannot prevent a recipient from taking a screenshot or copying the decrypted text. Once someone has the link and any required password, they can view the content. The security model is built on minimizing exposure, not on controlling what happens after decryption. The goal is to ensure that your sensitive information is never stored permanently and is accessible only to the intended recipient.

If you need a safe way to share passwords, credentials, or private messages, SneakNote is built to give you meaningful protection with a simple, no-account-required experience. Try creating a secure note and see how it works for yourself.